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CLAIMS 

What is claimed is: 

1 . A method for automatically analyzing network events, comprising: 
generating a matrix that illustrates relationships between a plurality of network events 

and a focal event from the plurality of network events or that illustrates relationships between a 
plurality of network objects and a focal object from the plurality of network objects; and 
automatically analyzing the matrix by evaluating at least one event vector. 

2. The method of claim 1 , wherein the matrix is based in part on a resource 
topology or an event topology. 

3. The method of claim 1 , wherein the matrix illustrates connectivity relationships 
among the plurality of network objects. 

4. The method of claim 1 , wherein the matrix illustrates dependency relationships 
among the plurality of network objects. 

5. The method of claim 1 , wherein the matrix illustrates time relationships between 
the plurality of network events and the focal event. 

6. The method of claim 1 , wherein the matrix illustrates a relative distance among 
the plurality of network events or the plurality of network objects. 

7. The method of claim 1 , further comprising: 

filtering the plurality of network events before generating the matrix. 

8. The method of claim 1 , further comprising: 

applying event-specific or object-specific rules or policies to a result of the analysis of the 

matrix. 

9. The method of claim 1 , wherein the matrix is populated with identifiers of the 
plurality of network objects or identifiers of the plurality of network events. 
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10. The method of claim 1 , wherein the at least one event vector is a set of network 
events from the plurality of network events along a path of related network objects from the 
plurality of network objects. 

1 1 . The method of claim 1 , wherein the automatic analyzing comprises a 
sympathetic event reduction, which comprises: 

identifying at least one related event from the plurality of network events; 

correlating the at least one related event to the focal event; and 

hiding at least one redundant sympathetic event from the plurality of network 

events. 

12. The method of claim 1 , wherein the automatic analyzing comprises a 
dependency analysis, which comprises locating common dependencies among the plurality of 
network objects. 

13. The method of claim 1 , wherein the automatic analyzing comprises an impact 
analysis, which comprises determining which of the plurality of network objects are affected by 
the focal event. 

14. The method of claim 1 , wherein the automatic analyzing comprises a predictive 
analysis, which comprises determining which of the plurality of network objects would be 
affected by a hypothetical focal event. 

15. The method of claim 1 , wherein the automatic analyzing comprises a root cause 
analysis, which comprises identifying and prioritizing at least one suspected root event from the 
plurality of network events as a potential root cause of the focal event. 

16. The method of claim 15, wherein the identifying and prioritizing the at least one 
suspected root event comprises: 

identifying at least one leaf-node event from the plurality of network events; 
ranking the at least one leaf-node event according to ranking factors; and 
suppressing each of the plurality of network events that are in the at least one 
event vector and that are not the focal event or the at least one leaf-note event, 

wherein the ranking factors comprise the angle of the at least one event vector, a 
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time dispersion along the at least one event vector, and a consistency of event types along the 
at least one event vector. 

1 7. The method of claim 1 , further comprising: 

displaying the focal event, at least one other event of the plurality of network events, and 
the relationships between the focal event and the at least one other event on a user interface, 

wherein each of the displayed plurality of network events is displayed as one of a 
plurality of network event icons in one of a plurality of colors to indicate event severity, and 

wherein each of the displayed plurality of network event icons is displayed with a clock- 
like arc in one of two colors to represent a time relationship as compared to the focal event. 

18. The method of claim 17, wherein the displaying is static or dynamic. 

19. The method of claim 17, wherein only the focal event and at least one leaf-node 
event from the plurality of network events are displayed. 

20. The method of claim 17, wherein the relationships are illustrated with a plurality 
of lines connecting at least two of the displayed plurality of network events. 

21 . The method of claim 20, wherein the plurality of lines vary in thickness and 
composition to illustrate rank. 

22. A machine-readable medium that provides instructions for automatically 
analyzing network events, which, when executed by a machine, cause the machine to perform 
operations comprising: 

generating a matrix that illustrates relationships between a plurality of network events 
and a focal event from the plurality of network events or that illustrates relationships between a 
plurality of network objects and a focal object from the plurality of network objects; and 

automatically analyzing the matrix by evaluating at least one event vector. 

23. The machine-readable medium of claim 22, wherein the matrix is based in part 
on a resource topology or an event topology. 

24. The machine-readable medium of claim 22, wherein the matrix illustrates 
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connectivity relationships among the plurality of network objects. 
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25. The machine-readable medium of claim 22, wherein the matrix illustrates 
dependency relationships among the plurality of network objects. 

26. The machine-readable medium of claim 22, wherein the matrix illustrates time 
relationships between the plurality of network events and the focal event. 

27. The machine-readable medium of claim 22, wherein the matrix illustrates a 
relative distance among the plurality of network events or the plurality of network objects. 

28. The machine-readable medium of claim 22, wherein the instructions cause the 
machine to perform operations further comprising: 

filtering the plurality of network events before generating the matrix. 

29. The machine-readable medium of claim 22, wherein the instructions cause the 
machine to perform operations further comprising: 

applying event-specific or object-specific rules or policies to a result of the analysis of the 

matrix. 

30. The machine-readable medium of claim 22, wherein the matrix is populated with 
identifiers of the plurality of network objects or identifiers of the plurality of network events. 

31 . The machine readable medium of claim 22, wherein the at least one event vector 
is a set of network events from the plurality of network events along a path of related network 
objects from the plurality of network objects. 

32. The machine-readable medium of claim 22, wherein the automatic analyzing 
comprises a sympathetic event reduction, which causes the machine to perform operations 
comprising: 

identifying at least one related event from the plurality of network events; 

correlating the at least one related event to the focal event; and 

hiding at least one redundant sympathetic event from the plurality of network 

events. 
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33. The machine-readable medium of claim 22, wherein the automatic analyzing 
comprises a dependency analysis, which comprises locating common dependencies among the 
plurality of network objects. 

34. The machine-readable medium of claim 22, wherein the automatic analyzing 
comprises an impact analysis, which comprises determining which of the plurality of network 
objects are affected by the focal event. 

35. The machine-readable medium of claim 22, wherein the automatic analyzing 
comprises a predictive analysis, which comprises determining which of the plurality of network 
objects would be affected by a hypothetical focal event. 

36. The machine-readable medium of claim 22, wherein the automatic analyzing 
comprises a root cause analysis, which comprises identifying and prioritizing at least one 
suspected root event from the plurality of network events as a potential root cause of the focal 
event. 

37. The machine-readable medium of claim 36, wherein the identifying and 
prioritizing the at least one suspected root event causes the machine to perform operations 
comprising: 

identifying at least one leaf-node event from the plurality of network events; 

ranking the at least one leaf-node event according to ranking factors; and 

suppressing each of the plurality of network events that are in the at least one 
event vector and that are not the focal event or the at least one leaf-note event, 

wherein the ranking factors comprise the angle of the at least one event vector, a 
time dispersion along the at least one event vector, and a consistency of event types along the 
at least one event vector. 

38. The machine-readable medium of claim 22, wherein the instructions cause the 
machine to perform operations further comprising: 

displaying the focal event, at least one other event of the plurality of network events, and 
the relationships between the focal event and the at least one other event on a user interface, 
wherein each of the displayed plurality of network events is displayed as one of a 
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plurality of network event icons in one of a plurality of colors to indicate event severity, and 

wherein each of the displayed plurality of network event icons is displayed with a clock- 
like arc in one of two colors to represent a time relationship as compared to the focal event. 

39. The machine-readable medium of claim 38, wherein the displaying is static or 
dynamic. 

40. The machine-readable medium of claim 38, wherein only the focal event and at 
least one leaf-node event from the plurality of network events are displayed. 

41 . The machine-readable medium of claim 38, wherein the relationships are 
illustrated with a plurality of lines connecting at least two of the plurality of network events. 

42. The machine-readable medium of claim 41 , wherein the plurality of lines vary in 
thickness and composition to illustrate rank. 
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